Maybe a customer emailed to say your site is redirecting to a dodgy page. Maybe Google is showing a warning next to your listing, or your host has suspended the account. However you found out, the first instinct is panic. Take a breath. A hacked website is a common, fixable problem, and acting in the right order makes recovery faster and more complete.
Signs your site has been compromised
Not every hack is obvious. Watch for:
- Unexpected redirects, pop-ups or adverts you did not add
- Strange new pages, often in another language, appearing in search results
- Admin users you do not recognise
- Browser or search engine security warnings
- Your host reporting malware, spam emails or unusual resource use
- Files changed recently that nobody on your team touched
Step one: contain the damage
Start by limiting the harm while you investigate.
- Put the site into maintenance mode or take it offline if it is serving malware to visitors
- Tell your host; they may be able to help and need to know anyway
- Change passwords for the website admin, hosting control panel, FTP or SFTP, database and domain registrar
- Turn on two-factor authentication wherever it is available
- Remove any unknown admin accounts
Do this from a computer you trust. If your own machine is infected, new passwords may be stolen straight away.
Step two: preserve evidence
Before deleting anything, take a copy of the hacked site and its logs. This feels counterintuitive, but it helps you or a specialist understand how the attacker got in. Without knowing the entry point, you risk cleaning the site only to be hacked again the same way.
Step three: find the way in
Common causes include outdated plugins or themes, weak or reused passwords, a compromised developer computer, abandoned test sites on the same hosting and vulnerable custom code. Review server access logs around the time the problems began and check which components were out of date.
Step four: clean or restore
You have two broad options.
Restore from a clean backup
If you have a backup from before the hack, and you know roughly when the hack happened, restoring can be the fastest route. Then immediately update everything and fix the entry point, or the attacker will simply return.
Clean the existing site
If there is no clean backup, the site must be cleaned: replacing core files with fresh copies, reinstalling plugins and themes from official sources, scanning for malicious code in the database and uploads, and removing hidden backdoors. This is detailed work, and a professional is often worth it.
Step five: rebuild trust
Once the site is clean:
- Request a review in Google Search Console if your site was flagged
- Check your domain is not listed on email spam blacklists
- Review whether any customer data may have been accessed
If personal data might have been exposed, you may have legal obligations. In the UK and EU, GDPR sets deadlines for reporting certain breaches, and other regions have their own rules. Take advice early rather than late.
Step six: harden the site
Use the incident to raise your defences permanently:
- Keep the platform, plugins and themes updated, and remove anything unused
- Use strong, unique passwords and two-factor login for every admin
- Limit admin access to the people who truly need it
- Add a web application firewall and malware scanning
- Set up automatic, off-site backups and test them
Our guide to backing up a website properly explains how to make sure you have a clean copy next time.
FAQ
Should I just delete the site and start over?
Rebuilding can make sense for an old, neglected site, but you still need to find out how the attacker got in and secure your hosting and accounts, or the new site may be compromised too.
Will being hacked hurt my Google rankings?
It can, especially if Google flags the site or finds spam pages. Cleaning up quickly and requesting a review usually allows rankings to recover over time.
Why would anyone hack a small business website?
Most attacks are automated. Bots scan the internet for known weaknesses and exploit whatever they find, using sites to send spam, host malware or boost other pages' search rankings.
Next step
If your site has been hacked right now, focus on containment first, then get help. Export Apps can clean, secure and rebuild sites through our web development service. Contact us and tell us what you are seeing.